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IMPLEMENTATION  AND  PERFORMANCE  ANALYSIS  OF  MODIFIED  AES 
ALGORITHM  WITH  KEY-DEPENDENT  DYNAMIC  S-BOX  AND  KEY  MULTIPLICATION 


In  today's  world,  Internet  has  become  the  principal  means  of  communication  which  has  led  to  the  increased  use  of 
computer  communication  system  by  almost  all  organizations.  This  has  the  risk  of  threat  to  the  data  flowing  through  the 
network.  Encryption  is  the  most  extensively  used  cryptographic  countermeasure  for  these  threats.  The  most  popular  and 
strongest  block  cipher  algorithm  in  symmetric  key  cryptography  is  Advanced  Encryption  Standard  (AES).  In  this  paper, 
performance  comparison  of  Rijndael  which  is  existing  AES  algorithm  with  modified  AES  algorithm  through  diffusion 
analysis  in  terms  of  First  order  Strict  Avalanche  Criteria  (SAC)  and  Higher  order  SAC  is  done.  This  paper  provides  the  use 
of  dynamic  S-Box  which  is  dependent  on  the  key  provided  by  the  user  instead  of  standard  S-Box  which  is  used  in  the 
existing  AES.  The  generated  S-Boxes  increase  the  complexity  of  the  algorithm  and  cause  the  differential  and  linear 
cryptanalysis  more  difficult.  The  existing  AES  uses  key  addition  round  which  is  simpler  and  has  less  diffusion  power. 
To  overcome  this,  this  paper  also  provides  key  multiplication  method  to  enhance  the  diffusion  power. 

KEYWORDS:  Advanced  Encryption  Standard,  Strict  Avalanche  Criteria,  Diffusion  and  Confusion,  Differential  and 
Linear  Cryptanalysis 


Security  is  the  principal  goal  in  the  design  of  cryptographic  algorithm.  The  proliferation  of  computer  usage  and 
their  interconnections  through  network  have  increased  the  need  of  protection  of  information  stored  against  viruses,  hackers, 
eavesdroppers,  and  electronic  data  deception. 

The  four  basic  functions  provided  by  cryptographic  algorithms  are:  1)  Authentication  2)  Confidentiality 
3)  Non-repudiation  and  4)  Integrity.  Mathematical  functions  like  addition,  transposition,  substitution,  rotation,  etc.,  are 
used  to  randomize  the  cipher  value.  Such  operations  are  repeated  several  iterations  to  achieve  certain  required  diffusion 
level. 

1.1.  Cryptanalysis 

There  are  two  approaches  to  attack  a  conventional  encryption  algorithm. 
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Cryptanalysis:  This  is  the  type  of  attack  which  rely  on  the  algorithm's  nature  and  some  general  or  statistical 
property  of  the  plaintext.  The  attacker  may  also  have  some  sample  plaintext-ciphertext  pairs.  This  is  the  approach  to 
deduce  plaintext  or  key. 

Brute-Force  Attack:  This  is  the  type  of  attack  where  attacker  tries  every  possible  key  on  a  sample  ciphertext 
until  an  intelligible  translation  into  plaintext  is  obtained.  This  type  of  attack  is  not  possible  with  relatively  lengthy  key. 

1.2.  Confusion  and  Diffusion 

These  terms  were  introduced  by  Claude  Shannon  which  define  the  basic  techniques  for  any  cryptographic  systems 
to  thwart  cryptanalysis  based  on  statistical  analysis.  Or  in  other  words,  all  statistics  of  the  ciphertext  are  independent  of  the 
key  being  used  or  the  plaintext. 

Diffusion  is  to  make  the  statistical  relationship  between  ciphertext  and  plaintext  as  complex  as  possible.  That  is,  a 
small  change  in  plaintext  should  make  significant  changes  in  ciphertext  which  is  equivalent  to  saying  that  every  single  bit 
of  ciphertext  is  affected  by  many  plaintext  bits.  Confusion  is  to  make  the  statistical  relationship  between  ciphertext  and  key 
as  complex  as  possible.  That  is  a  small  change  in  key  should  make  a  significant  changes  in  ciphertext.  Every  encryption 
algorithm  does  use  the  diffusion  and  confusion  layers.  The  diffusion  layer  is  based  upon  the  linear  operations  such  as 
multi-permutations,  key  additions,  polynomial  multiplication  with  some  known  constants  etc.  The  confusion  layer  is  based 
on  the  non-linear  and  complex  operations  such  as  Substitution  Box  (S-Box)  (J.  Daemen  et  al,  1999). 

1.3.  Strict  Avalanche  Criteria  (SAC) 

SAC  is  the  desirable  property  of  an  encryption  algorithm  which  states  that  a  small  change  in  plaintext  or  key 
should  produce  significant  changes  in  ciphertext.  There  are  two  types  of  SAC:  1)  First  order  SAC:  It  is  expressed  in  terms 
of  change  in  output  bits  when  single  bit  is  changed  in  input  bits.  2)  Higher  order  SAC:  It  is  expressed  in  terms  change  in 
output  bits  when  multiple  bits  are  changed  simultaneously  in  input  bits. 

2.  ADVANCED  ENCRYPTION  STANDARD  ALGORITHM 

To  replace  the  Data  Encryption  Standard  (DES)  algorithm,  the  National  Institute  of  Standards  and  Technology 
(NIST)  in  1997,  issued  a  call  for  proposals  to  develop  and  choose  a  new  AES.  In  1998,  NIST  shortlisted  fifteen  candidate 
algorithms  and  later  narrowed  down  to  five  algorithms  based  on  security  and  efficiency  characteristics.  Finalists  which  are 
selected  as  AES  candidate  algorithms  are  MARS,  RC6,  Rijndael,  Serpent,  and  Twofish.  The  performance  comparison  is 
available  in  (Mohan  H.S  et  al,  2010).  In  November  2001,  NIST  selected  Rijndael  as  the  proposed  AES  algorithm  due  to  its 
high  level  security,  speed,  flexibility  and  ease  of  implementation. 

2.1.  Rijndael  Algorithm 

It  is  a  symmetric,  block  cipher  algorithm  developed  by  Joan  Daemen  and  Vincent  Rijmen.  The  algorithm  supports 
key  size  of  128,  192,  and  256  bits.  It  supports  data  block  length  of  128  bits  only  while  conserving  the  property  of  three 
different  key  lengths.  The  128  bit  data  block  is  organized  as  4X4  matrix  of  bytes  which  is  called  the  state.  This  state  is  fed 
to  four  basic  block  operations  -  ByteSub  transformation,  the  ShiftRow  transformation,  the  MixColumn  transformation,  and 
AddRoundKey. 


Impact  Factor  (JCC):  4.6257 


NAAS  Rating:  3.80 


Implementation  and  Performance  Analysis  of  Modified  AES  Algorithm  3 
With  Key-dependent  Dynamic  S-box  and  Key  Multiplication 

•  ByteSub  Transformation:  Non  linear  byte-by-byte  substitution  using  S-Box,  which  is  constructed  by  calculating 
multiplicative  inverse  followed  by  affine  transformation. 

•  ShiftRows  Transformation:  Simple  byte  transposition  which  is  a  linear  diffusion  process  operating  on  individual 
rows.  The  bytes  in  the  last  three  rows  of  the  state  are  cyclically  shifted;  the  offset  of  the  left  shift  varies  from  one 
to  three  bytes. 

•  MixColumn  Transformation:  It  is  equivalent  to  matrix  multiplication  over  GF(28)  of  columns  of  the  states.  Each 
column  vector  is  multiplied  with  a  fixed  matrix  and  the  bytes  are  treated  as  polynomials  rather  than  numbers. 

•  AddRoundKey:  Simple  XOR  between  the  working  state  and  the  round  key. 

These  operations  are  run  in  10,  12,  or  14  iterations  depending  on  the  size  of  the  key  -  128  bits,  192  bits,  or  256 
bits  respectively.  AES  algorithm  Encryption  structure  is  depicted  in  Figure  1. 
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Figure  1:  AES  Algorithm  Structure 

All  four  operations  described  above  have  corresponding  inverse  operations  such  as  Inv-SubBytes  which  uses 
inverse  S-Box,  Inv-ShiftRows,  and  Inv-MixColumn.  Same  sequence  of  operations  but  in  the  reverse  order  as  one  in  the 
encryption  structure  is  used  as  decryption  structure.  AddRoundKey  step  is  its  own  inverse  (Abd-ElGhafar  et  al,  2009). 

In  terms  of  the  critical  path  between  the  ciphertext  and  plaintext,  Rijndael  is  regarded  as  the  fastest  algorithm.  In 
section  3,  we  introduce  a  new  approach  for  the  generation  of  S-Box  which  is  dynamic  in  nature  and  dependent  on  the  key 
provided.  This  results  in  the  increased  complexity  of  S-Box  generation  and  hence  the  diffusion  power.  This  makes  the 
differential  and  linear  cryptanalysis  more  difficult.  In  section  4,  we  introduce  Key  Multiplication  operation  instead  of 
AddRoundKey  which  is  much  complex  operation  in  terms  of  diffusion.  In  this  paper  we  also  make  the  performance 
comparison  of  Rijndael  algorithm  with  modified  AES  with  the  above  two  modules  mentioned  in  terms  of  CPU  time  and 
diffusion  power  analysis  that  is  First  order  SAC  and  Higher  order  SAC. 

3.  GENERATION  OF  DYNAMIC  S-BOX 


S-Box  is  used  to  perform  byte  substitution  operation.  AES  defines  16X16  matrix  of  byte  values  which  contains  a 
permutation  of  all  possible  256values  which  are  of  8-bit  in  size.  Each  individual  byte  of  state  is  replaced  by  a  new  value 
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from  this  S-Box  in  following  way:  The  leftmost  nibble  is  used  as  row  index  to  the  S-Box  and  rightmost  nibble  is  used  as 
column  index  to  the  S-Box.  The  corresponding  inverse  S-Box  is  used  for  decryption  operation. 

3.1.  Related  Studies 

(Abd-ElGhafar  et  al,  2009)  state  that  it  is  possible  to  generate  our  own  S-Box  by  choosing  different  constant  value 
which  is  used  in  the  affine  transformation.  (J.  Juremi  et  al,  2012)  proposed  a  substitution  box  that  makes  use  of  the  RC4 
key  schedule  algorithm  (KSA).  The  resulting  matrix  is  a  key-dependent  S-box  based  that  is  dynamically  generated. 
In  (Mohan  H.  S.  et  al,  2011  (b)),  authors  have  proposed  another  key  dependent  S-box  that  will  substitute  the  Rijndael 
S-box.  In  their  paper,  they  modified  the  AES  cipher  by  placing  another  phase  in  the  beginning  of  the  round  function.  They 
call  the  extra  phase  as  the  S-box  Rotation  that  will  rearrange  by  way  of  rotating  the  Rijndael  S-box  according  to  a  round 
key.  The  round  key  is  derived  from  the  cipher  key  using  the  key  schedule  algorithm.  The  rotation  value  is  dependent  on  the 
entire  round  key.  The  results  of  their  study  showed  that  it  does  not  violate  the  security  of  the  cipher  by  doing  the 
enhancement  on  the  original  AES.  The  enhanced  version  introduces  confusion  without  violating  the  diffusion  property. 

3.2.  Standard  S-Box  Construction 

The  standard  S-Box  is  constructed  in  the  following  fashion: 

•  Initialize  the  S-Box  with  1  to  256  values  as  16X16  matrix  in  ascending  order  row  by  row. 

•  Find  the  multiplicative  inverse  of  each  byte  in  the  S-Box  in  the  finite  GF(28) 

•  Apply  affine  transformation  to  each  bit  in  each  byte  of  S-Box  in  the  following  way.  Consider  that  each  bit  in  the 
byte  of  S-Box  is  labeled  (b7,  b6,  b5,  b4,  b3,  b2,  bb  b0) 

b-b,®     b(l-4)modS  ®     b(l-5)mods  ®    b(l-6)modS  ®     b(i-7)mod8  ®  S 

where  Cj  is  the  i-th  bit  of  byte  c  with  the  value  {63},  that  is,  c7c6c5c4c3c2clc0)  =  (01100011).  The  prime  (') 
indicates  that  the  variable  is  to  be  updated  by  the  value  on  the  right.  The  AES  standard  depicts  this  transformation  in  matrix 
form  as  follows: 
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Each  element  in  the  product  matrix  is  the  bitwise  XOR  of  elements  of  one  row  and  one  column.  Further,  the  final 
addition,  shown  in  the  above  equation  is  a  bitwise  XOR,  the  inverse  S-box  is  obtained  by  taking  the  inverse  of  equation, 
affine  transformation  followed  by  taking  the  multiplicative  inverse  in  GF  (28).  As  an  example,  consider  the  input  value 
{95}.  The  multiplicative  inverse  in  GF  (28)  is  {95  }-1  =  {8a},  which  is  10001010  in  binary.  Using  the  above  equation,  the 
result  is  {2A}. 
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3.3.  Proposed  Modified  AES  with  dynamic  S-Box 

The  new  dynamic  S-Box  is  constructed  based  on  the  fact  that  the  state  always  has  permutation  of  all  8 -bit 
numbers  from  0  to  255.  In  this  design,  the  key  schedule  algorithm  is  used  to  produce  the  permutation  to  generate  multiple 
S-Boxes  dynamically.  This  is  constructed  as  the  following  steps: 

•  The  first  S-Box  is  the  Rijndael  S-Box  and  is  given  as  an  array  S  which  is  constructed  as  explained  in  the  section 
3.2. 

•  After  providing  the  input  key,  initialize  as  follows 
J=0; 

For  1=0  to  255 
k[  i]=key[  i  mod  key  length  ]; 
J=(j+s[i]+k[i])mod  256; 
exchange  (S[i],  S[j]) 

•  The  output  of  the  second  step  gives  256  different  values  and  the  generated  permutation  of  values  depend  on  the 
input  key.  If  we  change  one  byte  value  in  the  input  key  we  get  another  permutation  of  256  values.  Hence  it  is 
possible  to  construct  256!  S-Boxes  depending  on  the  input  key. 

•  For  the  produced  256  values,  apply  affine  transformation  one  again  as  applied  in  the  original  S-Box,  to  avoid  any 
fixed  points  and  to  make  new  S-Box  invertible. 

Consider  the  S-Box  generated  for  two  sample  keys.  Keys  are  given  in  decimal  number  where  1  bye  is  expressed 
as  3  decimal  digits. 


Example  1:  Key  1  =015025035045055065075085095105115125135145155165.  The  generated  S-box  is  given  in 
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Figure  2:  S-Box  Generated  for  Key  1 

Example2:  Key  2  =111121131141151161171181191112122132142152162172.  The  generated  S-box  is  given  in 
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Figure  3:  S-Box  Generated  for  Key  2 


4.  PROPOSED  AES  ALGORITHM  WITH  KEY  MULTIPLICATION 

In  existing  AES  algorithm,  the  128  bits  of  state  is  organized  into  4X4  matrix  and  each  byte  of  state  is  XORed  with 
byte  of  round  key  which  is  derived  by  means  of  key  schedule.  This  block  is  copied  into  4X4  state  array  and  is  modified  at 
each  stage  of  encryption  and  decryption.  In  modified  AES  algorithm  as  proposed  in  (Mohan  H.  S.  et  al,  2011  (a)),  by 
multiplying  each  byte  of  state  with  byte  of  round  key,  it  is  possible  to  achieve  more  confusion  and  more  diffusion  than  key 
addition  which  is  simple  XOR  operation.  This  is  due  to  the  fact  that  the  multiplication  operation  is  much  complex  than 
addition  and  also  consumes  some  time.  The  structure  of  revised  AES  algorithm  is  shown  in  Figure  4. 

Plaintext(128  bits) 


KeyMut  p  car  cm: 


Ke,  Mu  t  p  cat  en 


KeyMultiplkrationfi)  _ 


KeyM  uttipfcation 


V(Nr-l) 


KevMultip)ication(Nr)— 


Cphertext(128  bits) 


Figure  4:  AES  with  Key  Multiplication 


4.1.  Problem  Faced  and  Solution 


The  keys  can  have  any  value  from  0  to  255.  If  key  has  value  0,  then  multiplication  of  state  byte  with  value  0  will 
give  the  byte  value  0  which  is  loss  of  that  state  data.  To  solve  this  problem,  it  is  checked  for  value  0  when  the  key  is 
expanded.  If  present,  then  it  is  replaced  by  value  1 .  The  inverse  of  keys  is  taken  by  calculating  multiplicative  inverse  of 
each  byte  and  is  used  in  decryption. 

5.  PERFORMANCE  ANALYSES 

Diffusion  analysis  is  made  for  First  order  SAC  and  Higher  order  SAC  considering  the  following  cases: 

•  Flipping  single  bit  in  plaintext  while  keeping  key  constant. 

•  Flipping  multiple  bits  in  plaintext  while  keeping  key  constant. 

•  Flipping  single  bit  in  key  while  keeping  plaintext  constant. 
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•     Flipping  multiple  bits  in  key  while  keeping  plaintext  constant. 
5.1.  Time  Analysis 

The  performance  of  modified  AES  algorithm  is  measured  in  terms  of  CPU  time  required  for  encryption, 
decryption,  key  set  up,  and  S-Box  generation.  These  parameters  were  measured  for  standard  Rijndael  algorithm,  modified 
AES  with  dynamic  S-Box  only,  and  modified  S-Box  with  key  multiplication  only.  Corresponding  graphs  are  shown  in  the 
figure  5. 

Table  1:  CPU  Time  Comparison 


Standard 
S-Box 

Dynamic 
S-Box 

Key 
Addition 

Key 
Multiplication 

Encryption 
(seconds) 

0.20558 

0.22388 

0.23988 

0.22512 

Decryption 
(seconds) 

0.28773 

0.2683 

0.24117 

0.33817 

Key 
Schedule 
(seconds) 

0.12726 

0.11527 

0.14133 

0.13263 

S-Box 
Generation 
(seconds) 

1.5555 

1.5817 

1.5995 

1.5052 

Rijndael  Sbox 


■  Key  Schedule 

■  Sbox  Generation 


Figure  5:  Comparison  of  Time  Required  for  all  Operations  with  Standard  AES  and  Modified  AES 
5.2.  Diffusion  Analysis 

The  strength  of  any  cryptographic  encryption  algorithm  is  estimated  by  diffusion  analysis.  The  diffusion  analysis 
states  how  cipher  values  are  sensitive  to  the  input  changes  made  to  either  plaintext  or  key.  Strict  Avalanche  Criteria  (SAC) 
is  defined  to  indicate  the  required  diffusion  level.  In  this  paper  avalanche  values  were  calculated  for  the  four  cases  which 
are  mentioned  in  the  beginning  of  this  section.  First  order  and  higher  order  SAC  values  are  provided  in  Table  2. 
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Table  2:  First  order  and  Higher  order  Avalanche  Calculations 


Round 
Number 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

First 
Order 
SAC 

Key  Addition 

20 

61 

62 

71 

63 

73 

67 

55 

58 

58 

Key 

Multiplication 

14 

71 

68 

66 

61 

72 

64 

60 

60 

72 

Standard 
SBox 

12 

66 

63 

61 

73 

71 

59 

56 

54 

55 

Dynamic 
SBox 

17 

67 

63 

66 

66 

62 

79 

62 

64 

67 

Higher 
Order 
SAC 

Key  Addition 

80 

67 

76 

70 

70 

56 

66 

71 

56 

59 

Key 

Multiplication 

58 

70 

68 

60 

62 

60 

70 

63 

66 

68 

Standard 
SBox 

66 

65 

71 

70 

64 

63 

67 

60 

64 

56 

Dynamic 
SBox 

54 

57 

64 

70 

62 

61 

65 

56 

70 

66 

The  graphs  comparing  SAC  values  for  different  modules  with  standard  AES  are  shown  in  the  following  Figures. 
Each  graph  shows  the  SAC  value  after  every  round.  Figure  6  and  Figure  7  show  the  comparison  of  first  order  SAC  and 
higher  order  SAC  with  key  multiplication  and  dynamic  S-Box  modules  separately. 


■  Redact  SBox 

■  Dynamic  SBox 


Figure  6:  First  Order  SAC  Vs  Round  Number  for  Standard  AES  and  Modified  AES  with  Individual  Modules 


■  Riindacl  Sbox 

■  Dynamic  SBox 


Figure  7:  Higher  Order  SAC  Vs  Round  Number  for  Standard  AES  and  Modified  AES  with  Individual  Modules 

The  first  order  SAC  was  obtained  by  changing  single  bit  in  input  bits  and  cipher  value  changes  for  all  ten  rounds 
are  observed.  As  it  is  observed  in  Figure  6,  after  tenth  round,  we  have  achieved  good  SAC  value  with  key  multiplication 
and  dynamic  S-Box.  This  proved  that  the  diffusion  power  of  modified  AES  algorithm  is  more  compared  to  standars 
Rijndael  algorithm.  Figure  7  shows  the  Higher  order  SAC  values.  Higher  order  SAC  was  obtained  by  simultaneously 
changing  multiple  bits  in  input  bits  observing  the  cipher  values  for  all  ten  rouds.  As  it  is  shown  in  the  graphs,  we  have 
achieved  good  SAC  value  with  modified  AES  algorithm  with  key  multiplication  and  dynamic  S -Boxes. 
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Observations  were  also  made  for  modified  AES  with  both  key  multiplication  and  dynamic  S -boxes.  Table  3 
shows  the  first  order  and  higher  order  SAC  calculations  for  standard  AES  and  modified  AES. 


Table  3:  First  Order  and  Higher  Order  Avalanche  Calculations 


Round 
Number 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

First 
Order 
SAC 

Standard 
AES 

21 

62 

57 

75 

70 

56 

63 

64 

71 

61 

Modified 
AES 

14 

66 

66 

72 

72 

66 

64 

58 

62 

71 

Higher 
Order 
SAC 

Standard 
AES 

68 

65 

70 

56 

71 

60 

59 

64 

64 

61 

Modified 
AES 

63 

72 

69 

72 

53 

61 

58 

56 

62 

66 

The  graphs  comparing  SAC  values  for  standard  and  modified  AES  algorithm  is  shown  in  Figure  8.  The  graphs 
show  that  the  modified  algorithm  with  key  multiplication  and  dynamic  S -Boxes  together  yields  higher  diffusion  strength 
than  standard  AES  algorithm. 


Figure  8:  First  Order  and  Higher  Order  Comparison  for  Standard  AES  and  Modified  AES 


6.  CONCLUSIONS  AND  FUTURE  ENHANCEMENTS 

The  basic  design  of  any  cryptographic  system  lies  on  the  diffusion  and  confusion  strength.  In  this  paper  we 
explored  the  diffusion  and  confusion  elements  of  AES.  Here  we  also  implemented  and  showed  the  experimental  results  of 
modified  AES  algorithm  with  key  multiplication  and  dynamic  S-Boxes.  Both  standard  and  modified  S-Boxes  are  generated 
to  measure  the  avalanche  value  as  well  as  CPU  time  required  for  generation.  The  measured  values  indicate  that  the  revised 
AES  has  higher  diffusion  and  confusion  power  which  increase  the  security  of  AES.  The  higher  CPU  time  required  for  both 
of  these  operations  is  the  indication  of  higher  complexity  of  the  modified  algorithm.  We  can  further  increase  the  security  of 
AES  by  using  two  keys  one  for  S-Box  generation  and  the  other  for  encryption.  The  encrypted  data  can  be  hidden  in  image 
to  further  protect  the  data  while  transferring  over  Internet.  It  is  possible  to  make  the  algorithm  further  complex  and  high 
powered  in  terms  of  diffusion  and  confusion  by  expanding  the  state  matrix  from  4X4  to  8X8  or  16X16  and  so  on. 
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